Bug 2513015 (CVE-2026-19387)

Summary: CVE-2026-19387 gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code execution when untrusted media is processed.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2513017, 2513018    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-10 02:25:27 UTC 
A flaw was found in GStreamer gst-plugins-bad (adpcmdec). The IMA/DVI ADPCM decoder validated the per-block sample count with (n_samples - channels) % 8 == 0, which does not ensure alignment with the decode loop that writes 8 * channels samples per iteration. A crafted multi-channel IMA ADPCM WAV can pass this check and cause a heap out-of-bounds write of decoded sample values that are partially derived from attacker-controlled compressed audio data. The adpcmdec element is auto-plugged by decodebin/playbin, so processing untrusted media (players, thumbnailers, transcoders) can trigger the issue, resulting in application crash, denial of service, memory corruption, or potentially code execution. Fixed upstream in gst-plugins-bad 1.28.6 (GStreamer-SA-2026-0077).
Comment 1 errata-xmlrpc 2026-08-17 03:57:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:55433 https://access.redhat.com/errata/RHSA-2026:55433
Comment 2 errata-xmlrpc 2026-08-17 23:04:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:55865 https://access.redhat.com/errata/RHSA-2026:55865
Comment 3 errata-xmlrpc 2026-08-18 21:13:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:56521 https://access.redhat.com/errata/RHSA-2026:56521
Comment 4 errata-xmlrpc 2026-09-08 08:33:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:65123 https://access.redhat.com/errata/RHSA-2026:65123
Comment 5 errata-xmlrpc 2026-09-08 08:34:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:65122 https://access.redhat.com/errata/RHSA-2026:65122
Comment 6 errata-xmlrpc 2026-09-08 09:10:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:65124 https://access.redhat.com/errata/RHSA-2026:65124